Aletheia
Back to Aletheia Subprocessors and Data Residency
Status: v1.4.17 disclosure. Effective 2026-10-09.
The v1.4.17 hosted service is designed for London-region processing and local-first analysis. Provider contracts, support access, routing, and model processing can create international transfers; contractual safeguards and provider data controls are used where applicable.
| Provider | Purpose | Expected region or transfer |
|---|---|---|
| Fly.io | Control plane, authenticated web application, and local-node coordination | London (lhr) |
| Neon | Postgres operational and derived evidence | London region |
| Cloudflare | DNS, encrypted backup objects, purge registry | Global edge; configured R2 account |
| Clerk | Authentication and account identity | Provider-managed regions |
| Stripe | Billing and payment records | Provider-managed global service |
| Anthropic and enabled model providers | Agent inference for user-requested sessions | The configured Aletheia Anthropic workspace uses the US data location; customer-selected provider accounts follow their selected provider regions and terms |
| Sentry | Opt-in, filtered error diagnostics | Configured Aletheia project uses Germany; provider terms govern support access and transfers |
| PostHog | Bounded product analytics when enabled | Configured Aletheia project uses PostHog EU |
| Grafana Cloud | Aggregate operational metrics and alerting, including readiness, backup freshness and spending counters | Configured Aletheia stack uses London (prod-gb-south-1) |
| GitHub | Signed release distribution and operational workflows | Provider-managed regions |
Raw customer binaries remain encrypted on the customer's device. Analysis decrypts them only into an owner-only ephemeral local session directory and bind-mounts them read-only into a signed, networkless Docker worker on that device. Original-file uploads remain prohibited. The selected file's native host path and display name are not supplied as cloud metadata or context. Application authentication and provider credentials remain subject to their authentication controls and are not supplied as analysis metadata or context. Logs, metrics, analytics and diagnostics must not receive customer analysis content.
Explicitly consented derived context may include recovered strings, function names and decompiled text. The Fly control plane and selected model providers may process that context; retained derived evidence may enter tenant-scoped Neon storage and its encrypted R2 backups under the retention policy. This text may contain sensitive or proprietary material. Existing filters for named fields and common path patterns remain in place, but cannot guarantee removal of all filenames, paths or credentials embedded in recovered text. Consider the file's sensitivity, sharing authority and listed destinations before consenting; future analysis output need not already be available to review. Proof-byte export retains its separate native approval and does not authorize original binary upload.
The v1.4.17 native review shows the account, selected file hash, new-analysis or named-restore scope, execution mode, Aletheia cloud destination, and any selected provider and model. Approval is internally scoped to the device and selected analysis; a new run ID does not yet exist at review. Declining cancels startup; changing provider or destination requires renewed consent. Withdrawal stops future work and transmission, but does not erase prior provider records. Provider capabilities, retention and zero-data-retention status should be evaluated separately before consenting; Aletheia deletion controls do not promise deletion from a provider's independent records.
There is separate approval for each prepared Workbench agent. The native prompt names the local agent, while Aletheia internally binds approval to its prepared session, executable and launch configuration without displaying those technical identifiers. Derived context delivered to that recipient may reach services selected in that agent's own configuration; Aletheia does not control those downstream provider choices. Restarting or changing the recipient requires fresh approval. This local recipient approval does not expand tool execution permission or promise to govern the agent's independent provider retention arrangements. Connection interruption stops the managed Workbench recipient; restart and review it again after the analysis reconnects. Previously delivered data may remain with the agent or its configured services; stopping the managed process does not recall those records.
Material subprocessor changes will be published here. DPA and transfer requests may be sent to [email protected].
Configuration facts checked: 2026-09-07.